MyBB Community Forums

I'm wondering what the best way would be to fix years of goofiness with permissions on forums (and even groups) during a planned move. I'd like to be able to reset all forums to default permissions and then after I fix the groups, reapply permissions in a more well thought out way than has happened from various people over the years.

To me it never seemed like the inheritance works the way that one would assume. Also the management of individual user groups becomes a bit of a major task within subforums. In any event we will be simplifying our user groups by converting most to a few key access categories then using a few secondary groups that would allow for some additional access when needed.

If there's anyone out there who understands the underpinning sell enough I'd love to get suggestions on how to proceed. If I knew a way to more easily reset or work the forms and their children it would make things easy but I fear that using a query to reset all forums would be just as difficult as doing it manually unless there's a way to also effect changes at the forum level that can be passed onto it's children. I don't even understand where permissions settings defaults come from when I make a new TOP level forum.

Looking at the docs it's not immediately clear if/where information regarding the forums setup and permission and inheritance would be.

If this seems vague I apologize. Maybe I'm not explaining correctly. I'll answer any questions to clarify if needed.

Thanks,
gmO

(2020-01-24, 01:42 PM)gmOlds Wrote: [ -> ]I'm wondering what the best way would be to fix years of goofiness with permissions on forums (and even groups) during a planned move. I'd like to be able to reset all forums to default permissions and then after I fix the groups, reapply permissions in a more well thought out way than has happened from various people over the years.

To me it never seemed like the inheritance works the way that one would assume. Also the management of individual user groups becomes a bit of a major task within subforums. In any event we will be simplifying our user groups by converting most to a few key access categories then using a few secondary groups that would allow for some additional access when needed.

If there's anyone out there who understands the underpinning sell enough I'd love to get suggestions on how to proceed. If I knew a way to more easily reset or work the forms and their children it would make things easy but I fear that using a query to reset all forums would be just as difficult as doing it manually unless there's a way to also effect changes at the forum level that can be passed onto it's children. I don't even understand where permissions settings defaults come from when I make a new TOP level forum.

Looking at the docs it's not immediately clear if/where information regarding the forums setup and permission and inheritance would be.

If this seems vague I apologize. Maybe I'm not explaining correctly. I'll answer any questions to clarify if needed.

Thanks,
gmO

Yep, I'm facing this problem, too. Seems there's no easy way of resetting permissions of child/grandchild forums to be inherited from their parent forum at AdminCP. Direct SQL query might work, I suppose, but I don't know how to write that query.

I'd run a query but don't know where to start with writing. If I could reset them all to some default I guess I could walk through them manually but as a multi game and globally dispersed guild we have a LOT of subforums. It might almost make more sense to move the current forums structure under one OLD top level and setup new forums and then move threads from each subforum into the new structure.

Problem is I think weird permissions happen when you do this because in my testing I've moved threads from an area that had one set of permissions into a new subforum with strict permissions and low level members could read the threads. They couldn't get the index to the new subforum but, for example, if they saw someone who should have access reading the thread one who's online screen they could click and see the thread.

I looked roughly on how MyBB handles inheritance and if all is working as expected, it should not give any weird problem. Inheritance is handled when the forumpermissions cache is updated (so they are not stored) in order to save space and have more dynamicity when forums are moved to other parents (I guess).

Imagine this category structure:

c_1
    f_1
        f_1.1
        f_1.2
            f_1.2.1
            f_1.2.2
    f_2
        f_2.1

In c_1 you set a custom permission (deny the posting of threads) to the registered group: all its children are gonna inherit the same permission. If you open one of its child forums, you will notice that the registered group have inherited the permission set on c_1, but it is not custom, just inherited. N.B. This means that the inheritance of permissions is something that you can actually see and get updated manually, MyBB does not handle it on the fly.

c_1 # no threads (custom)
    f_1 # no threads (inherit)
        f_1.1 # no threads (inherit)
        f_1.2 # no threads (inherit)
            f_1.2.1 # no threads (inherit)
            f_1.2.2 # no threads (inherit)
    f_2 # no threads (inherit)
        f_2.1 # no threads (inherit)

In f_1.2 you set a custom permission (allow the posting of threads) to the registered group, restoring it from the inheritance got from c_1: all its children (f_1.2.1, f_1.2.2) are gonna inherit the same permission.

c_1 # no threads (custom)
    f_1 # no threads (inherit)
        f_1.1 # no threads (inherit)
        f_1.2 # yes threads (custom)
            f_1.2.1 # yes threads (inherit)
            f_1.2.2 # yes threads (inherit)
    f_2 # no threads
        f_2.1 # no threads

In f_1 you set a custom permission (deny the posting of replies, in addition to the inherited permission got from c_1) to the registered group: just f_1.1 is gonna inherit this permission, because f_1.2 have already its custom permission set and can no longer inherit from its parents.

c_1 # no threads (custom)
    f_1 # no threads & replies (custom)
        f_1.1 # no threads & replies (inherit)
        f_1.2 # yes threads (custom)
            f_1.2.1 # yes threads (inherit)
            f_1.2.2 # yes threads (inherit)
    f_2 # no threads (inherit)
        f_2.1 # no threads (inherit)

Then, you decide to clear the registered group custom permissions initially set on c_1 but just f_2 and f_2.1 are gonna inherit this clear, because f_1 have its custom permission on the registered group.

c_1
    f_1 # no threads & replies (custom)
        f_1.1 # no threads & replies (inherit)
        f_1.2 # yes threads (custom)
            f_1.2.1 # yes threads (inherit)
            f_1.2.2 # yes threads (inherit)
    f_2
        f_2.1

At last, you decide to move f_1.1 out of f_1, and since its actual permissions are inherited, its new permissions are gonna be inherited from c_1, which have no custom permissions, so default permissions.

c_1
    f_1 # no threads & replies (custom)
        f_1.2 # yes threads (custom)
            f_1.2.1 # yes threads (inherit)
            f_1.2.2 # yes threads (inherit)
    f_1.1
    f_2
        f_2.1

So, this means that you need to distinguish between custom permissions and inheritance of permissions. Probably an option to ignore the inheritance of permissions for a specific forum, would be useful, but not that necessary. At the end, inheritance is useful 97% of the time if you keep a good organization of your forums.

Going back to the question, what I can suggest is: review your usergroups keeping just the necessary; organize your forums taking into account that inheritance exists and it should helps you to make your forums more clear to users; reset all your forum permissions and set them again smartly taking advantage of inheritance and avoiding more than you can of nested custom permissions;

To reset all your forum permissions, just truncate your forumpermissions table with TRUNCATE TABLE mybb_forumpermissions and rebuild its cache preventively in the Cache Manager (ACP > Tools & Maintenance).

About the query for restoring fastly group permissions inherited from a parent (should be avoided as much as you can): default group permissions on forums are taken from the group permissions available in the group settings. Accordingly, for restore a group permission in a forum you need to create a new custom permission on this group copying its default permissions, something like that should do the trick:

INSERT INTO mybb_forumpermissions SELECT
    NULL,
    1 AS fid,
    gid,
    canview,
    canviewthreads,
    0,
    candlattachments,
    canpostthreads,
    canpostreplys,
    0,
    canpostattachments,
    canratethreads,
    caneditposts,
    candeleteposts,
    candeletethreads,
    caneditattachments,
    canviewdeletionnotice,
    modposts,
    modthreads,
    mod_edit_posts,
    modattachments,
    canpostpolls,
    canvotepolls,
    cansearch
FROM
    mybb_usergroups
WHERE
    gid IN (x,y,z)

Setting at the beginning the interested fid and at the end the groups to restore. With a more complex query or directly with a script you can detect groups that needs to be restored automatically.

(2020-01-24, 08:32 PM)gmOlds Wrote: [ -> ]I'd run a query but don't know where to start with writing. If I could reset them all to some default I guess I could walk through them manually but as a multi game and globally dispersed guild we have a LOT of subforums. It might almost make more sense to move the current forums structure under one OLD top level and setup new forums and then move threads from each subforum into the new structure.

If you could write a PHP script, you could use function get_child_list() (in ./inc/functions/php) to get an array of descendant forums' IDs of a specific forum, and delete all records that belong to the descendant forums in table mybb_forumpermissions to reset permissions of these forums for any usergroup to be inherited from their parent forum.

For SQL query, I don't work out an easy way to achieve that.

(2020-01-24, 08:32 PM)gmOlds Wrote: [ -> ]Problem is I think weird permissions happen when you do this because in my testing I've moved threads from an area that had one set of permissions into a new subforum with strict permissions and low level members could read the threads. They couldn't get the index to the new subforum but, for example, if they saw someone who should have access reading the thread one who's online screen they could click and see the thread.

If I were you, I'll check if such a user has multiple usergroups assigned and make sure all these group permissions for a specific forum is correctly set: view forum, view thread, view post, etc..

Anyway, current way of MyBB's managing permissions for users with multiple usergroups assigned is somehow problematic.

---

For complex settings of cascaded forum permissions, @Mipher's post above is a good depiction I think.